{"id":"CVE-2019-13164","aliases":["DEBIAN-CVE-2019-13164","DLA-1927-1","DSA-4506-1","DSA-4512-1","EUVD-2019-4691","GHSA-5ff7-wj9x-5xc5","SUSE-SU-2019:14151-1","SUSE-SU-2019:2157-1","SUSE-SU-2019:2192-1","SUSE-SU-2019:2221-1","SUSE-SU-2019:2246-1","SUSE-SU-2019:2353-1","UBUNTU-CVE-2019-13164","USN-4191-1","USN-4191-2","openSUSE-SU-2019:2041-1","openSUSE-SU-2019:2059-1","openSUSE-SU-2024:11287-1"],"status":"published","title":"qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that a network interface name (obtained from...","description":"qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00524,"percentile":0.44918,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2019-07-03T13:56:52Z","modified":"2026-10-24T14:13:04Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:4.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:4.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.47"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"qemu","fixed_in":["1:2.5+dfsg-5ubuntu10.42"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"qemu","fixed_in":["1:2.11+dfsg-1ubuntu7.20"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1+dfsg-12+deb8u12"}]}],"versions":["1:2.1+dfsg-11","1:2.1+dfsg-12","1:2.1+dfsg-12+deb8u1","1:2.1+dfsg-12+deb8u10","1:2.1+dfsg-12+deb8u11","1:2.1+dfsg-12+deb8u2","1:2.1+dfsg-12+deb8u3","1:2.1+dfsg-12+deb8u4","1:2.1+dfsg-12+deb8u4~bpo70+1","1:2.1+dfsg-12+deb8u5","1:2.1+dfsg-12+deb8u5a","1:2.1+dfsg-12+deb8u5a~bpo70+1","1:2.1+dfsg-12+deb8u6","1:2.1+dfsg-12+deb8u7","1:2.1+dfsg-12+deb8u8","1:2.1+dfsg-12+deb8u9","1:2.1+dfsg-12~bpo70+1"],"bundled":8},{"source":"osv","ecosystem":"Debian:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.8+dfsg-6+deb9u8"}]}],"versions":["1:2.8+dfsg-6","1:2.8+dfsg-6+deb9u1","1:2.8+dfsg-6+deb9u2","1:2.8+dfsg-6+deb9u3","1:2.8+dfsg-6+deb9u4","1:2.8+dfsg-6+deb9u5","1:2.8+dfsg-6+deb9u6","1:2.8+dfsg-6+deb9u7"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-8+deb10u2"}]}],"versions":["1:3.1+dfsg-8","1:3.1+dfsg-8~deb10u1"],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-60.27.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.55.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-9.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-9.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-33.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-33.26.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-9.28.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-9.28.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.18.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.47"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43","2.0.0+dfsg-2ubuntu1.44","2.0.0+dfsg-2ubuntu1.45","2.0.0+dfsg-2ubuntu1.46"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.42"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32","1:2.5+dfsg-5ubuntu10.33","1:2.5+dfsg-5ubuntu10.34","1:2.5+dfsg-5ubuntu10.35","1:2.5+dfsg-5ubuntu10.36","1:2.5+dfsg-5ubuntu10.37","1:2.5+dfsg-5ubuntu10.38","1:2.5+dfsg-5ubuntu10.39","1:2.5+dfsg-5ubuntu10.40","1:2.5+dfsg-5ubuntu10.41"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.20"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.42"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32","1:2.5+dfsg-5ubuntu10.33","1:2.5+dfsg-5ubuntu10.34","1:2.5+dfsg-5ubuntu10.35","1:2.5+dfsg-5ubuntu10.36","1:2.5+dfsg-5ubuntu10.37","1:2.5+dfsg-5ubuntu10.38","1:2.5+dfsg-5ubuntu10.39","1:2.5+dfsg-5ubuntu10.40","1:2.5+dfsg-5ubuntu10.41"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.20"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.47"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43","2.0.0+dfsg-2ubuntu1.44","2.0.0+dfsg-2ubuntu1.45","2.0.0+dfsg-2ubuntu1.46"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-lp151.7.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-lp151.7.3.2"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"qemu-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-lp151.7.3.3"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-lp150.7.25.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.0-32.1"}]}],"bundled":135}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"opensuse","product":"leap"},{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg00145.html","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix","report"]},{"url":"http://www.openwall.com/lists/oss-security/2019/07/02/2","tags":["mailing-list","x_refsource_MLIST","x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","report"]},{"url":"http://www.securityfocus.com/bid/109054","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"https://seclists.org/bugtraq/2019/Aug/41","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4506","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4512","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/Sep/3","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4191-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4191-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202003-66","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/qemu/qemu/commit/03d7712b4bcd47bfe0fe14ba2fffa87e111fa086","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13164"},{"url":"https://github.com/advisories/GHSA-5ff7-wj9x-5xc5"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13164","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914151-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1135902","tags":["report"]},{"url":"https://bugzilla.suse.com/1140402","tags":["report"]},{"url":"https://bugzilla.suse.com/1143794","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14378","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192157-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192192-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1128106","tags":["report"]},{"url":"https://bugzilla.suse.com/1133031","tags":["report"]},{"url":"https://bugzilla.suse.com/1134883","tags":["report"]},{"url":"https://bugzilla.suse.com/1135210","tags":["report"]},{"url":"https://bugzilla.suse.com/1136540","tags":["report"]},{"url":"https://bugzilla.suse.com/1136778","tags":["report"]},{"url":"https://bugzilla.suse.com/1138534","tags":["report"]},{"url":"https://bugzilla.suse.com/1144087","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5008","tags":["web"]},{"url":"https://bugzilla.suse.com/SLE-4883","tags":["report"]},{"url":"https://bugzilla.suse.com/SLE-6754","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192221-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192246-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1079730","tags":["report"]},{"url":"https://bugzilla.suse.com/1098403","tags":["report"]},{"url":"https://bugzilla.suse.com/1111025","tags":["report"]},{"url":"https://bugzilla.suse.com/1119115","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192353-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1127077","tags":["report"]},{"url":"https://bugzilla.suse.com/1134880","tags":["report"]},{"url":"https://bugzilla.suse.com/1136528","tags":["report"]},{"url":"https://bugzilla.suse.com/1136777","tags":["report"]},{"url":"https://bugzilla.suse.com/1139926","tags":["report"]},{"url":"https://bugzilla.suse.com/1141043","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-13164","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg00245.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4191-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4191-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13164","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12068","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-12155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-14378","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-15890","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TUKWOBV7QSC7BRGVOAZZDM7P4VZESISG/#TUKWOBV7QSC7BRGVOAZZDM7P4VZESISG","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/6SBK6URNJUYYH2QPGRG7N4UIGYSVXV6U/#6SBK6URNJUYYH2QPGRG7N4UIGYSVXV6U","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5225","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-6855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10155","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7161","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7170","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7908","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9602","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-10806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11334","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15118","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15268","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15289","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2615","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2630","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8309","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-11806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12130","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-12207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-15746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-3639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-03812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-15890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-8934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-11869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16092","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-29129","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-7039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20221","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20257","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20263","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3546","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3582","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3607","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3608","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3682","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-13164","description":"qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.","status":"published","published":"2019-07-03T13:56:52Z","modified":"2024-08-04T23:41:10.52Z","updated_at":"2026-11-02T14:20:24.025419Z"}],"euvd":[{"id":"EUVD-2019-4691","description":"qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.","status":"published","published":"2019-07-03T13:56:52Z","modified":"2024-08-04T23:41:10Z","updated_at":"2026-11-03T02:40:43.368399Z"}],"ghsa":[{"id":"GHSA-5ff7-wj9x-5xc5","title":"qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that a network interface name (obtained from...","description":"qemu-bridge-helper.c in QEMU 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.","status":"published","published":"2022-05-24T16:49:22Z","modified":"2023-01-27T05:07:27Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:43:07.326529Z"}],"nvd":[{"id":"CVE-2019-13164","description":"qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.","status":"published","published":"2019-07-03T14:15:10.37Z","modified":"2026-06-17T02:16:11.857Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:05:17.695191Z"}],"osv":[{"id":"CVE-2019-13164","description":"qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.","status":"published","published":"2019-07-03T14:15:10.37Z","modified":"2026-10-24T14:13:04.990624834Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13164","description":"qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.","status":"published","published":"2019-07-03T14:15:10.37Z","modified":"2026-09-21T07:00:57.489608406Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"UBUNTU-CVE-2019-13164","description":"qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.","status":"published","published":"2019-07-03T14:15:00Z","modified":"2026-02-04T02:34:36.920556Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-1927-1","title":"qemu - security update","status":"published","published":"2019-09-20T00:00:00Z","modified":"2026-03-09T01:19:16.971573Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4506-1","title":"qemu - security update","status":"published","published":"2019-08-24T00:00:00Z","modified":"2026-03-09T02:11:44.029528Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"DSA-4512-1","title":"qemu - security update","status":"published","published":"2019-09-02T00:00:00Z","modified":"2026-03-09T02:10:12.242969Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:2041-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).\n- CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).\n- CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).\n- CVE-2019-5008: Fix DoS (NULL pointer dereference) in sparc64 virtual machine possible through guest device driver (bsc#1133031).\n\nBug fixes and enhancements:\n\n- Upstream tweaked SnowRidge-Server vcpu model to now be simply Snowridge (jsc#SLE-4883)\n- Add SnowRidge-Server vcpu model (jsc#SLE-4883)\n- Add in documentation about md-clear feature (bsc#1138534)\n- Fix SEV issue where older machine type is not processed correctly (bsc#1144087)\n- Fix case of a bad pointer in Xen PV usb support code (bsc#1128106)\n- Further refine arch-capabilities handling to help with security and performance in Intel hosts (bsc#1134883, bsc#1135210) (fate#327764)\n- Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)\n- Ignore csske for expanding the cpu model (bsc#1136540)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2019-09-01T12:18:24Z","modified":"2026-02-04T03:41:21.917461Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2059-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).\n- CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).\n- CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).\n\nBug fixes and enhancements:\n\n- Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational\n  arch-capabilities to help with security and performance on Intel hosts (bsc#1134883) (fate#327764)\n- Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)\n- Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The\n  issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was\n  removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).\n- Ignore csske for expanding the cpu model (bsc#1136540)\n- Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-09-03T04:19:16Z","modified":"2026-02-04T03:14:49.483144Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:11287-1","title":"qemu-6.1.0-32.1 on GA media","description":"These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:08:57.481645Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"SUSE-SU-2019:14151-1","title":"Security update for kvm","description":"This update for kvm fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).\n- CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).\n- CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).\n","status":"published","published":"2019-08-21T16:01:41Z","modified":"2026-02-04T03:38:56.328467Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2157-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).\n- CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).\n- CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).\n","status":"published","published":"2019-09-06T14:08:36Z","modified":"2025-05-02T04:08:41.96046Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2192-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).\n- CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).\n- CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).\n- CVE-2019-5008: Fix DoS (NULL pointer dereference) in sparc64 virtual machine possible through guest device driver (bsc#1133031).\n\nBug fixes and enhancements:\n\n- Upstream tweaked SnowRidge-Server vcpu model to now be simply Snowridge (jsc#SLE-4883)\n- Add SnowRidge-Server vcpu model (jsc#SLE-4883)\n- Add in documentation about md-clear feature (bsc#1138534)\n- Fix SEV issue where older machine type is not processed correctly (bsc#1144087)\n- Fix case of a bad pointer in Xen PV usb support code (bsc#1128106)\n- Further refine arch-capabilities handling to help with security and performance in Intel hosts (bsc#1134883, bsc#1135210) (fate#327764)\n- Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)\n- Ignore csske for expanding the cpu model (bsc#1136540)\n","status":"published","published":"2019-08-21T16:00:29Z","modified":"2026-02-04T03:02:32.861743Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2221-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).\n- CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).\n- CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).\n","status":"published","published":"2019-08-27T09:12:49Z","modified":"2026-02-04T03:27:41.596405Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2246-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).\n- CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).\n- CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).\n\nBug fixes and enhancements:\n\n- Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational\n  arch-capabilities to help with security and performance on Intel hosts (bsc#1134883) (fate#327764)\n- Add support for one more security/performance related vcpu feature (bsc#1136778) (fate#327796)\n- Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The\n  issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was\n  removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).\n- Ignore csske for expanding the cpu model (bsc#1136540)\n- Fix vm migration is failing with input/output error when nfs server is disconnected (bsc#1119115)\n","status":"published","published":"2019-08-28T15:50:19Z","modified":"2026-02-04T02:48:59.276404Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2353-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-14378: Security fix for heap overflow in ip_reass on big packet input (bsc#1143794).\n- CVE-2019-12155: Security fix for null pointer dereference while releasing spice resources (bsc#1135902).\n- CVE-2019-13164: Security fix for qemu-bridge-helper ACL can be bypassed when names are too long (bsc#1140402).\n\nBug fixes and enhancements:\n\n- Add vcpu features needed for Cascadelake-Server, Icelake-Client and Icelake-Server, especially the foundational\n  arch-capabilities to help with security and performance on Intel hosts (bsc#1134880) (fate#327764).\n- Add support for one more security/performance related vcpu feature (bsc#1136777) (fate#327795).\n- Disable file locking in the Xen PV disk backend to avoid locking issues with PV domUs during migration. The\n  issues triggered by the locking can not be properly handled in libxl. The locking introduced in qemu-2.10 was\n  removed again in qemu-4.0 (bsc#1079730, bsc#1098403, bsc#1111025).\n- Ignore csske for expanding the cpu model (bsc#1136528).\n- Provide qcow2 L2 caching improvements, which allows for better storage performance in certain configurations (bsc#1139926, ECO-130).\n- Fixed virsh migrate-setspeed (bsc#1127077, bsc#1141043).\n","status":"published","published":"2019-09-11T06:59:02Z","modified":"2026-02-04T04:13:37.184964Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4191-1","title":"qemu vulnerabilities","description":"It was discovered that the LSI SCSI adapter emulator implementation in QEMU\ndid not properly validate executed scripts. A local attacker could use this\nto cause a denial of service. (CVE-2019-12068)\n\nSergej Schumilo, Cornelius Aschermann and Simon Wörner discovered that the\nqxl paravirtual graphics driver implementation in QEMU contained a null\npointer dereference. A local attacker in a guest could use this to cause a\ndenial of service. (CVE-2019-12155)\n\nRiccardo Schirone discovered that the QEMU bridge helper did not properly\nvalidate network interface names. A local attacker could possibly use this\nto bypass ACL restrictions. (CVE-2019-13164)\n\nIt was discovered that a heap-based buffer overflow existed in the SLiRP\nnetworking implementation of QEMU. A local attacker in a guest could use\nthis to cause a denial of service or possibly execute arbitrary code in the\nhost. (CVE-2019-14378)\n\nIt was discovered that a use-after-free vulnerability existed in the SLiRP\nnetworking implementation of QEMU. A local attacker in a guest could use\nthis to cause a denial of service. (CVE-2019-15890)\n","status":"published","published":"2019-11-14T00:14:42Z","modified":"2026-04-27T15:48:43.0295916Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4191-2","title":"qemu vulnerabilities","description":"USN-4191-2 fixed a vulnerability in QEMU. This update provides the\ncorresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that the LSI SCSI adapter emulator implementation in QEMU\n did not properly validate executed scripts. A local attacker could use this\n to cause a denial of service. (CVE-2019-12068)\n\n Sergej Schumilo, Cornelius Aschermann and Simon Wörner discovered that the\n qxl paravirtual graphics driver implementation in QEMU contained a null\n pointer dereference. A local attacker in a guest could use this to cause a\n denial of service. (CVE-2019-12155)\n\n Riccardo Schirone discovered that the QEMU bridge helper did not properly\n validate network interface names. A local attacker could possibly use this\n to bypass ACL restrictions. (CVE-2019-13164)\n\n It was discovered that a heap-based buffer overflow existed in the SLiRP\n networking implementation of QEMU. A local attacker in a guest could use\n this to cause a denial of service or possibly execute arbitrary code in the\n host. (CVE-2019-14378)\n\n It was discovered that a use-after-free vulnerability existed in the SLiRP\n networking implementation of QEMU. A local attacker in a guest could use\n this to cause a denial of service. (CVE-2019-15890)\n","status":"published","published":"2019-11-14T00:25:35Z","modified":"2026-04-27T15:48:48.600116291Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}